Slashdot Mirror
Brazilian Coders Are Pioneering the First Cross-OS Malware Using JAR Files
An anonymous reader writes: Criminal gangs in Brazil are experimenting with the first malware families that are packaged as JAR files, capable of being deployed to Windows, Linux, Mac, and even Android from the same codebase, instead of relying on 4 different versions. Right now, only the malware dropper, a component used to infect computers with banking trojans, seems to have been coded in Java, but security experts expect a full-blown banking trojan to soon follow.
It wouldn't need to run as a browser plugin. The idea here is to use some other exploit to gain access and drop the .jar file onto the system, then run it as a regular local application. I suspect a lot of people have it because Oracle's made deals to have it included on the manufacturer's images, and those people don't have a clue what Java is or how to remove it so that's a problem.
I am, however, surprised it took them this long to come up with this idea. It's fairly standard on Unix systems, that's how cross-platform scripting of all sorts is done.
Ah, but if the malware needs a Java Runtime Enviroment then it can just install that, too. :)
The bigger question, though, is whether being the language of choice for writing malware is a plus or a minus for a language. I mean, let's say someone writes some very clever malware in C. Does that mean that C is a powerful and expressive language? Or does it mean that C is the devil?
Well, that's a bad analogy because we already know that C is the devil. But you get the picture.
There's no Java for CP/M-Z80, so I'm safe from being target by cross platform malware [or being targeted by applications in general].
Guess all those memories of viruses from the 80's containing executable code valid on multiple processors are all my fevered imagination. Who knew that the first cross-OS malware was definitely only being written now, in 2016, in Java.
Wait, no, just the dropper. Congrats guys, you've discovered a platform-independent way of opening a stream from somewhere on the internet and dumping it to a file. Definitely pushing the envelope of Java to do that, I mean it's not like it comes with any sockets or file API specifically designed for stuff like that.
Give me a break. I was hoping to hear about something actually creative, like PDF or jpeg with multiple exploits for common Windows/Mac/Linux viewers or decode libraries, that causes a jump into the appropriate shellcode for each platform depending on what it's viewed on. This story is a non-event.
tl;dr: nearly all banks require jre here.
As a Brazilian, i must say: a LOT of lazy coders rely on java for everything.
i am not bashing java, i meant relying on it for EVERYTHING.
(even on my cs graduation some teachers where promoting java as the only language you will ever use, forever)
to make things worse, they usually make very sloppy code, that even rely on older, vulnerable and discontinued jre versions.
(not kidding, the government is the main culprit and even run critical web stuff that still require i.e. 6.0 emulation to work)
and well.. awkwardly speaking, nearly all banks require jre. (some do offer workarounds)
"First Cross-OS Malware Using JAR Files"
I used to have that one. It was developed by Sun, and called the Java plugin.
Well, that's a bad analogy because we already know that C is the devil. But you get the picture.
Well, any reasonably skilled programmer have several deals with the devil, and for about half of them the devil feels he got the short end of the stick.
My comments are usually ascii pentagrams, but they only show with a tabsize of 4.
*cross-platform scripting* usually involves perl, sh or similar scripting language. There really is no need to use java for that. And no, it isn't standard at all. If I need java on a system for a new fancy software I always have to install it first. You get flash preinstalled more often than java.
It also isn't that hard to deploy a miniperl to provide a runtime on systems without built-in perl (aka windows).
How exactly does this JAR file get downloaded and executed on a Linux system, without enduser action.
"Java: write once, run anywhere"
Sorry, couldn't help.
I don't think so.
http://virus.wikidot.com/esperanto
Anyone interested in arduino for starters?
another reason to uninstall java.
Unicode killed the ASCII-art *
>Dice employees used to be the lowest form of life
Used to be ?!??!?!
Unicode killed the ASCII-art *
Write once, pwn everwhere!
Monstar L
2008: http://citeseerx.ist.psu.edu/v...
2009: https://en.wikipedia.org/wiki/...
2010: https://nakedsecurity.sophos.c...
Look what some moron said about the same subject back in 2011:
http://www.developers.slashdot...
2012: https://www.intego.com/mac-sec...
2012: http://www.zdnet.com/article/c...
2012: http://www.infosecisland.com/b...
etc., etc.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
Uhhh...last I checked everyone that has Minecraft has Java, that is a LOT of Java installs.
That is why I hate the git that made Minecraft, after years of watching Java die on the desktop here comes this twirp that makes an insanely popular game in java and BAM! Piles of shitty Java installs cropping up everywhere.
ACs don't waste your time replying, your posts are never seen by me.
The idea here is to use some other exploit to gain access and drop the .jar file onto the system, then run it as a regular local application.
If malware gains local application code execution, then the target user is pretty much farked anyways -- the language used is irrelevant.
meep
I'm a Brazillian that works with IT, and it's the first time that I'm hearing something about it: it seems to me like a pretty bad-made SCAM :/
* I may be wrong, but I doubt it :P
This is why OS architectures like Qubes are important. This is why Linux systems (and everything else) should work more like that. It is also why the principle of least authority needs to make its way out of textbooks and into real life. Malware like this can work because it is given permission to work. There is no reason things need to be that way, except for laziness of programmers.
John_Chalisque
Brazilians rely on JRE to process their income tax.
Linux is for people who don't mind RTFM.
I wish our crackers were more patriotic. Last week, we learned about some malware that fails to work in computers located in Russia; why can't our malware coders create pieces of malware that *fail* when they find a JRE?
Linux is for people who don't mind RTFM.
It's written like a piece on an OSS project. When I got to the end, I was thinking, "Why are these researchers making malware?" Had to go back and re-read the first two words.
Download some Minecraft mods, take a peek inside.
All the more insidious because generally it is children installing said mods.
I am very small, utmostly microscopic.
I need it to play Minecraft. So yes, yes I do.
You say things that offend me and I can deal with it. Can you?
Almost every smart phone does. The browser thing is just irrelevant, you obviously do not understand anything about this ecosystem.
Achille Talon
Hop!
Don't mind the little fact that Macs don't even come with Java pre-installed anymore.
Almost every smart phone does.
Almost every smart phone, except for Android and iPhone where the JRE isn't available at all...
Full of shit! * but the drinking water, for the Olympics in Rio, is very well drinkable (the Guanabara Bay is not a source of drinking water :P)
* I live in Rio Claro / SP (not really very near of Guanabara Bay, thought...)
There are plenty of malware packages in PHP, Perl, Python, and Ruby that will search for vulnerable web apps, infiltrate a hosting account, then set up web-accessible shells written in the same languages and continue on to find more vulnerable apps and accounts.
Does anyone actually install a JRE any more?
Yeah, I didn't think it was very many.
Yes, lots of people install JREs.
The browser plugin isn't used much anymore, but there's lots of applications that use Java on a desktop (and lots, lots more that use it on servers, but I'll leave them alone for now.)
Some ones that come to mind are Minecraft, Eclipse (and a bunch of other programming IDEs and tools), Roboforge, OpenOffice, Vuze, Runescape, FreeCol, JOSM, Genj ...
Hell, I haven't had Java installed in years, maybe a decade.
It was of limited use and screwed up other stuff, and it made my PC slow to a crawl.
Just cruising through this digital world at 33 1/3 rpm...
They still have JVMs
No they don't. all of he "JVM" stuff for ios runs on the development machine and does static translation to native code.
(android even moved BACK to oracles and ditched Dalvik)
No they didn't. They ditched the harmony project and started using the openjdk libraries.
The VM itself is still dalvik only instead of going right from dalvik opcodes to native code it goes dalvik->llvm->native code.
Android does not and has never supported java bytecode. You must recompile java bytecode to dalvik bytecode on your development ahead of time. Just like if you want to use java with ios. This means a jar file containing java bytecode will not and can not run on iPhones or android phones.
automatically converts and runs JRE files in Android?
I don't believe it.
You're kidding, right?
"So long and thanks for all the fish."
Well, they've sold /. so, presumably, they've moved up a notch.
"So long and thanks for all the fish."
Yea he is so incompetent to get the idea to execution first and a billion on the way. Your just Jealous
If information wants to be free, why does my internet connection cost so much?
If we assume they are written in Java... then certainly we can do some profiling... just look for people with less hair.
Yea he is so incompetent to get the idea to execution first and a billion on the way. Your just Jealous
He wasn't the first to get the idea into a game, though. He was the first to make it popular. Sadly, popular and good are orthogonal axes on the chart.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Or in Ruby, or Python, or any number of other languages. Java's just another entry in the list here. Frankly I'd've expected the first cross-platform malware to be in Perl, and to have shown up at least 10 years ago. I'm not sure AV tools would even recognize a Perl program as malware...
I think of it more as /. getting a shot of penicillin actually.
Unicode killed the ASCII-art *
Are you REALLY this fucking dumb or are you just such a giant fangirl that the thought of anybody pointing out that "ur fav game its bestest evar!" had a very poorly thought out backend make you rush to post without engaging your tiny brain? That is if it does exist.
I don't give a rat's ass if he made a good game or not what I DO give a fuck about is he used the most dangerous runtime in existence to make the fucking thing, for fucks sake he may have well used ActiveX for the level of risk he put his customers in. in this day and age when there are literally dozens of game engines to choose from makes his brain dead fucking choice all the more egregious and the only nice thing I can say about it is since MSFT bought it I'm sure it'll end up porting off Java which will be a truly wonderful day for everyone...well except for you who are apparently too dumb to understand anything complex like PC security or risk factors. Sorry I don't have time to break out MS Paint and draw you some pictures to explain in a way you can understand but I have grown up things to do kid.
ACs don't waste your time replying, your posts are never seen by me.